{"schema":"threatline.record/2","record":{"id":"CVE-2026-111637","aliases":[],"summary":"NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint","details":"NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.","categories":["Unclassified"],"product":"NexoPOS","vendor":"Blair2004","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111637","source_modified_at":"2026-10-16T19:12:40.180Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"NexoPOS","vendor":"Blair2004","versions":[{"version":"0","lessThanOrEqual":"6.2.4","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00465,"percentile":0.3931,"score_date":"2026-10-23"},"published_at":"2026-10-16T17:39:08.931Z","modified_at":"2026-10-16T19:12:40.180Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111637","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T19:12:40.180Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111637","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T19:11:59.509726Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T19:12:40.180Z","content_hash":"0c61cc714f4f13675efb067c97df9dc8edbf59cdbf9e77b56dc54f78d7f144c7"}}